Risk Assessment of Excipients

Proper risk assessment and risk mitigation are crucial for pharmaceutical manufacturing to ensure product quality. A proposed new standard, the NSF/IPEC 363: Good Manufacturing Practices for Pharmaceutical Excipients, requires application of risk-assessment principles to prevent contamination from personnel, equipment, and facilities. Risk management is also used in supplier qualification, change management, and rework activities. Industry experts share their perspectives on risk assessment and mitigation in excipient manufacture and the excipient supply chain.  

The International Pharmaceutical Excipients Council of the Americas (IPEC-Americas) and NSF International, an accredited standards developer of the American National Standard Institute (ANSI), have developed a new American national standard for excipient GMPs, the NSF/IPEC 363: Good Manufacturing Practices for Pharmaceutical Excipients. The proposed standard, which is being finalized, is based on the IPEC-PQG Excipient GMP Guide, a joint initiative between the International Pharmaceutical Excipients Council (IPEC) and the Pharmaceutical Quality Group (PQG). The proposed standard defines GMPs for excipient manufacture for use in drug products and specifies the components of a quality-management system for excipient manufacture consistent with the GMP principles in the IPEC-PQG Excipient GMP Guide. The proposed NSF/IPEC 363 standard requires application of risk-assessment principles to define and justify appropriate GMP controls in order to mitigate risk to prevent contamination from personnel, equipment, and facilities. Risk assessment also is used for supplier qualification, change management, and rework activities.

To understand how risk-assessment principles have and can be applied across the excipient supply chain, Pharmaceutical Technology moderated an industry roundtable at ExcipientFest 2013, which was held in Baltimore, Apr. 29 to May 1, 2013. Some highlights of that roundtable are provided with  input from the following panelists: Irwin Silverstein, chief operating officer, International Pharmaceutical Excipients Auditing (IPEA); Janeen Skutnik, partner, NSF-DBA, chair of the IPEC Federation, past chair of IPEC-Americas, and former director of quality strategy at Pfizer; Steven Wolfgang, PhD, associate director, Risk Science, Intelligence and Prioritization (acting), FDA’s Center for Drug Evaluation and Research, Office of Compliance, Office of Drug Security, Integrity and Recalls; Dale Carter, global quality director, silica, J.M. Huber Engineered Materials, member of the IPEC-Americas Executive Committee, and immediate past chair of IPEC-Americas; and Meera Raghuram, manager for global regulatory affairs and strategies at Lubrizol and current chair of the IPEC-Americas Regulatory Affairs Committee.  

Proposed NSF/IPEC 363 standardPharmTech: What was the rationale for developing the NSF-IPEC standard and how did it come into being?

Skutnik (NSF-DBA): One of the key rationales we had was the IPEC-PQG GMPs that were revised in 2006. In the 2008-2009 timeframe, IPEC, as an organization, decided that it wanted to evolve the guideline to the next level so that we could possibly have it used and referenced by the agency, by other agencies around the world, and take it into a standard, an auditable standard, as opposed to a guideline.  

At that point, we had a discussion with NSF to develop an American national standard. We felt it was an important step forward to create a document that could be used officially as an auditable standard that would be in compliance with the Office of Management and Budget Circular A119, which establishes policies on federal use and development of voluntary consensus standards. This measure is guidance to US government agencies to allow them to refer to consensus-based standards in lieu of developing a standard within an agency of the US government.  

We pulled together experts on excipients, not only from the US and industry, but also from regulatory authorities and public-health agencies in Europe and the US, and of course, key industry representatives who not only worked on the IPEC-PQG original GMPs but also those who have been involved and knowledgeable about excipients for 20, 30, and 40 plus years. It’s been a great process in terms of getting people together and looking at harmonizing expectations. Again, it is not just focused on what’s important in the US, but also what is important globally.  

In terms of the specifics of the standard, certainly anyone familiar with the IPEC guidance will notice a lot of the same key things are emphasized as well as those familiar with ICH Q10 Pharmaceutical Quality System or ISO guidelines. It is focused on a robust, effective quality-management system. It helps you understand what a quality culture is within a company. Whether you’re talking about pharmaceuticals, excipients, or APIs, if a company doesn’t embrace a quality culture, it will always struggle with GMP compliance because if people don’t understand the importance of quality, they’re not ever going to quite get there. The standard helps you assess and look at what the quality culture of a company is by how it approaches all the different elements of a quality-management system. There are expectations for what the appropriate facilities and controls are, what the appropriate documentation is, and what the appropriate personnel and training are. That is something that, time and time again, is very important, not only for excipient manufacturers, but for all parties throughout the supply chain to understand what they’re doing, why they’re doing it, and how it translates to a patient outcome or a patient impact.

Appropriate test methods and controls are part of an overall process. It is an auditable standard, so it provides a tool for overall supplier qualification. It incorporates all the necessary elements from ICH Q10 Pharmaceutical Quality System and Q9 Quality Risk Management.  

PharmTech: How does the proposed NSF-IPEC standard build upon the IPEC-PQG Excipient GMP Guide?

Carter (J.M. Huber): The IPEC-PQG guide is just that, a guideline, so in certain sections, such as air handling, utilities, personnel protection, and gowning, it would provide several examples of what to do in certain situations. For example, it would say that if you needed a controlled environment, then you had to control it. It was written in a way that those reasonably knowledgeable of what they were doing could look at it and make reasonable decisions and put in their own programs and processes. What the ANSI standard did was it took those examples and translated them into a standard that you could audit. For example, rather than getting prescriptive, it specifies you must do a risk assessment. It took the elements that were already in the guide and said consider these points. The proposed standard then took the points or the examples we gave in the guide to help someone understand and relate them to his/her own process and put them as a kind of a mnemonic for conducting the risk assessment. The standard preloaded your risk assessments by stating the risk questions, ‘What are you trying to prevent, and how are you doing that?’ And in trying to prevent this end, consider these things. The proposed standard  does that throughout by talking about work environment, utilities, control of gowning or personnel, rework, or other aspects that made it into a standard that could be audited.

For the excipient manufacturer, what it does is it puts a little work on you. To convert from being a IPEC-GMP-compliant company into being a company that could be certified under the about-to-be-released ANSI standard, you’re going to have to go back and justify why you did these things. The advantage is now you’ve protected from loss of knowledge through attrition and have the ability to understand from the documented risk assessment what the reasoning was for these programs; it really created a standard that people could implement.

Regulatory expectationsPharmTech: How is the proposed NSF-IPEC standard compatible with FDA’s expectations and with other agency guidance?

Wolfgang (FDA): In terms of pharmaceutical quality systems, I think there is a lot of compatibility between the standards that are like the ICH guidelines and the approaches that are being recommended in those guidelines and the ANSI NSF 363 standard because you are talking about applying risk-based approaches, establishing quality management systems, and emphasizing the importance of senior management responsibility, which is really part of building the quality culture within an organization. If your senior management doesn’t support it, then, certainly, it’s not going to be supported throughout the organization. In terms of the types of practices that we’ve been trying to encourage finished dosage form manufacturers to apply, we’re seeing a lot of progress in terms of building the same type of approaches throughout the pharmaceutical supply chain, including excipients.  

Pharmaceutical company perspectivePharmTech: From a pharmaceutical company perspective, how does the NSF-IPEC standard satisfy the information and documentation that a pharmaceutical company would need?  

Skutnik (NSF-DBA): One of the key things is the proposed standard creates a level playing field, which is very important, not just for pharmaceutical companies, but also for excipient manufacturers as well because if there are too many different standards and different expectations, nobody’s expectations are met. The standard creates a clear set of expectations, so everybody’s on the same page as to what is important to the quality of an excipient, which is something very important for a pharmaceutical user.  

Excipient manufacture perspectivePharmTech: From the perspective of excipient manufacturers, how does the proposed NSF-IPEC standard provide needed flexibility for the excipient manufacturer while providing the needed documentation and information that the excipient user might need in its requirements?

Carter (J.M. Huber): From my perspective, what the standard allows you to do, using the risk-assessment model, is to describe what you do and to justify it. It allows you to make the same safe product and then add to it some of the quality and consistency requirements needed for drug products and explain that and communicate it in a controlled way because there is a common standard. The excipient manufacturer is not being audited by different standards from the pharmaceutical industry.  

Raghuram (Lubrizol): From an excipient manufacturer’s perspective, we have always used risk assessment to make informed decisions, but where the gap was may not have been always documented. For example, we may ask, ‘Why are we doing this?’ The answer may be ‘We have always done it this way. We have done it this way for the past 20 years and it has worked well.’ What the standard does is it forces you to look at the quality performance, customer requirements, and the safety of the excipients and document why you are using certain controls or why you may not need certain controls in certain places. There is a large advantage to implementing and having a consistent standard across the board.

Best practices for risk assessmentPharmTech: In speaking about risk assessment in general, what constitutes a good risk assessment? Can you provide insight into best practices for risk assessment, and how they can be applied in terms of complying with the proposed IPEC-NSF standard and other measures?

Silverstein (IPEA): Risk assessment is going to be quite new to excipient manufacturers. It seems as though it has been rolled out, obviously, in the pharmaceutical industry, but the industry is still wrestling with the proper way to deal with it. There will be an expectation to document a risk assessment because this is a very comprehensive standard, and it’s recognized that you probably won’t run into an excipient manufacturer that has to deal with all the requirements of NSF 363. Those elements that don’t apply to this specific excipient situation or the site of manufacture will have to have a risk assessment to support the fact that those requirements don’t apply. Then, of course, you’re going to have to do risk assessments where the standard calls for a risk assessment to decide the level of compliance with that specific requirement.

And so, there are basically three elements that I would be looking for in a risk assessment. First, there’s identification. You need a good, solid identification statement for the risk that clearly delineates what the scope is. In this portion, we would expect you to define the harm, meaning the potential harm to the patient if the excipient is exposed to that risk.  There are direct hazards and indirect hazards. Examples of direct hazards are from chemical, physical, or microbiological contamination by exposure of the excipient to the risk. There also are indirect hazards that may become apparent, and they can lead to stability failures. They also may lead to manufacturing problems at the pharmaceutical manufacturer and drug shortages; those are examples of indirect hazards.

The second key element is analysis. We would expect that there’ll be an analysis conducted on the identified risk to determine what is the probability. The probability can be ranked in terms of perception as high, medium, or low, but it also can be classified from a scale of 1 to 3 or even 1 to 10. Then there’ll be an assessment that will determine the probability of the risk and a separate assessment of what is the severity of the risk--what’s the impact if this exposure to the excipient does occur as it relates to the patient and patient safety, which can either be through a direct or indirect hazard.

Finally, there’s an evaluation. Now that you have the probability and the severity, you combine the two in a fashion that leads to a severity rating for the risk and that will determine the level of protection you need to apply. After you complete the risk analysis and you put in your control measures, you ought to challenge the measures to see if they are effective. There is a need for confirmation of the efficacy of the measures you have put into place.

Good distribution practicesPharmTech: Can you discuss how the standards relate to good distribution practices (GDPs)?

Skutnik (NSF-DBA): Certainly, from the US, there is the expectation that it is the entire supply chain. You can have the best quality systems in place at the excipient manufacturer, but if there are no controls once the product leaves the door, what good is it, really? All of that is wasted.  

The same expectations and the same core principles exist whether talking about the excipient or the finished drug. On the food side, there’s a new concept, called ‘farm to fork,’ which looks across the entire distribution chain of the food product. We don’t yet have a similar term on the pharma side, but that is absolutely critical and has to exist because of issues such as diversion. While the pharmaceutical manufacturer is ultimately responsible, we all have a part to play. This new focus on risk assessments, on what could possibly go wrong, helps us secure that entire supply chain.  

Wolfgang (FDA): I think it’s fair to say that the distribution system is very important when it comes to excipients, and certainly we’ve seen this with finished drug products as well, where within wholesale distribution, for example, things can go wrong. You may have an authorized distributor of record but then you may have other parties that also can get their hands on excipients or drugs in the supply chain. Certainly, it would be a good idea to have some oversight over that part of the supply chain as well and make sure that they’re following the right practices.

Silverstein (IPEA): I think it’s worth remembering that the shipment of excipients from Point A to Point B is generally from a common carrier. Unless they’re a full truckload, the shipment is going to go by whatever trucking company has been authorized to pick up the shipment. You can audit the nodes, but it’s very difficult to see the transition from Point A to Point B. That puts the onus on the pharmaceutical company to do an adequate job of confirming that the product hasn’t been tampered with prior to its being received at its door. And I think it’s worth pointing out that FDA pushed back on the whole notion of tamper-evident seals, so that if you’re not going to use a tamper-evident seal on an excipient package, you will have to justify why there isn’t one available. So there’s a recognition by the agency that those tamper-evidence seals are important, but if the pharmaceutical companies don’t look for the presence of the proper tamper-evidence seal, what’s the value?

PharmTech: From an excipient manufacturer perspective, can you speak about the issue of risk mitigation in the supply chain from two vantage points: first, the supply chain between the excipient manufacturer to the pharmaceutical user and then the ingredient supply chain for a pharmaceutical excipient beginning with the raw materials for that particular excipient?  

Carter (J.M. Huber): Those are two large questions. With regard to the starting materials for excipients, let’s remember that an excipient that’s used in a drug product will be consumed by the patient. A raw material used in an excipient manufacture will be consumed by the process, go through purification steps, and come out a different material than what you started with; that’s the whole concept of processing. As those materials move through the process, they go from a more industrial setting into a more controlled setting, which implies the necessary controls all the way back to the starting materials. You do need to recognize that the whole business of chemical manufacturing is taking a lesser value product that is a commodity product, doing processing and purification, and turning it into a more value-added product. There has to be thorough risk management, meaning all the appropriate principles go back to the mine, for example, as the source for the material.

As far as the supply chain between the excipient manufacturer and pharmaceutical customer, that is a very interesting issue. Excipient companies prefer to ship full truckloads because it retains supply-chain integrity. Once you ship in less-than truckload (LTL), the shipment will probably dock in an pen area waiting for the next truck. And so LTL shipments are not a good thing. Unfortunately, excipients are used in such small amounts in pharmaceutical manufacturing, they can’t afford a full truckload. It would be the next three-year supply. There is a challenge in that and how you deal with it.  Hence, the need for distributors. An excipient manufacturer needs a good distributor to partner with in the next step, namely, the attachment to the pharmaceutical customers. They play a very valuable role and should be supported on both ends by the suppliers that give products to distributors and the customers that use the distributor.

Raghuram (Lubrizol): To comment from a process standpoint, I think excipient manufacturers have processes in place to evaluate the risk from all raw materials critical to the quality of the excipient. Implementing the appropriate level of control and procedures to ensure raw-material consistency and quality using a risk-based approach is important.